CVE-2022-41929: Missing Authorization in User#setDisabledStatus in org.xwiki.platform:xwiki-platform-oldcore
org.xwiki.platform:xwiki-platform-oldcore is missing authorization in User#setDisabledStatus, which may allow an incorrectly authorized user with only Script rights to enable or disable a user. This operation is meant to only be available for users with admin rights. This problem has been patched in XWiki 13.10.7, 14.4.2 and 14.5RC1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
org.xwiki.platform:xwiki-platform-oldcoreto a version that resolves this vulnerability.Fixed in 13.10.7 - Upgrade
Upgrade
org.xwiki.platform:xwiki-platform-oldcoreto a version that resolves this vulnerability.Fixed in 14.4.2 - Upgrade
Upgrade
org.xwiki.platform:xwiki-platform-oldcoreto a version that resolves this vulnerability.Fixed in 14.5RC1
Event History
Frequently Asked Questions
What is the severity of CVE-2022-41929?
CVE-2022-41929 is considered a medium severity vulnerability due to its potential to allow unauthorized user modifications.
How do I fix CVE-2022-41929?
To fix CVE-2022-41929, update XWiki to the latest version where the authorization checks for User#setDisabledStatus have been properly implemented.
Who is affected by CVE-2022-41929?
CVE-2022-41929 affects XWiki versions from 11.7 to 13.10.7 and from 14.0.0 to 14.4.2, including specific release candidates and updates.
What type of access is improperly authorized in CVE-2022-41929?
CVE-2022-41929 allows users with Script rights to enable or disable accounts, which is intended only for users with admin rights.
Can CVE-2022-41929 be exploited by any user?
While CVE-2022-41929 primarily targets users with Script rights, any such user could exploit this vulnerability to bypass normal user management restrictions.